CVE-2024-22433

High

Description

Dell Data Protection Search 19.2.0 and above contain an exposed password opportunity in plain text when using LdapSettings.get_ldap_info in DP Search. A remote unauthorized unauthenticated attacker could potentially exploit this vulnerability leading to a loss of Confidentiality, Integrity, Protection, and remote takeover of the system. This is a high-severity vulnerability as it allows an attacker to take complete control of DP Search to affect downstream protected devices.

SeverityHigh

CVSS8.8

Exploit probability—

ProductDell Data Protection Search

PublishedFeb 6, 2024

First seenFeb 6, 2024

Weakness typeCWE-538CWE-538

How to fix

Update

dell data_protection_search19.6.4 or later

Vendor advisories

dell.com/support/kbdoc/en-us/000221720/dsa-2024-063-security-update-for-dell-data-protection-search-multiple-security-vulnerabilities

Affected products

Product	Affected versions	Fixed in
dell data_protection_search	19.2.0 ≤ v < 19.6.4	19.6.4

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.